CVE-2026-44088
HighSummary
SzafirHost verifies the signature of the downloaded JAR file, but loads classes in a way that can lead to remote code execution. An attacker can combine a genuine, signed JAR file with a malicious ZIP file, allowing the malicious class to be loaded despite successful verification.
Risk Assessment
The organization is at risk of remote code execution, which could lead to system takeover or data leakage. Exploitation of this vulnerability could have serious consequences for application security.
Recommendation
It is recommended to upgrade to version 1.2.1, where the issue has been fixed. A security audit of the application should also be conducted to minimize the risk of similar vulnerabilities.
Other vulnerabilities in SzafirHost
See all- CVE-2026-13165High
A vulnerability in SzafirHost allows an attacker to inject a malicious native library into a JAR archive that is signed and verified. The signature verification uses a JarFile parser (reading the Central Directory), while extraction uses a JarInputStream parser (reading sequentially from local file headers). An attacker can insert a library entry between the last legitimate entry and the Central Directory, which is not seen by the signature verifier but is read and written by the extractor, leading to remote code execution.
- CVE-2026-26928High
A vulnerability in SzafirHost is due to lack of hash or digital signature verification for DLL, SO, JNILIB, or DYLIB files. An attacker can provide a malicious file that gets saved in the temp folder and executed by the application. Fixed in version 1.1.0.
Original NVD description (English source)
SzafirHost verifies the signature of the downloaded JAR file using class JarInputStream (reading from the beginning of the file), but loads classes using class JarFile/URLClassLoader (reading the Central Directory from the end). It can lead to remote code execution by allowing an attacker to combine a genuine, signed JAR file with a malicious ZIP file, causing the verification to pass but the malicious class to be loaded. This issue was fixed in version 1.2.1.